Duration
5 days
Overview
This intensive hands-on practical course ensures participants are knowledgeable about the security aspects related to
IT Systems and have the proficiency to secure the IT environment. It consists of 4 phases:
Phase 1: participants will be introduced to the overall concepts of security, and the need for a comprehensive security framework.
Phase 2: participants will become familiar with a variety of “tools of the trade” and be ‘walked through’ various attack scenarios related to commonly used applications, services and devices on “live” networks & systems.
Phase 3: participants will use the tools and techniques gained in Phase 2 to implement attack on a full “live” network.
This phase ensures that participants “can actually do” tasks rather than simply having theoretical knowledge. The facilitator will set up the environments and act as a guide and mentor as required.
Phase 4: is the assessment which consists of both a theory and a practical assessment. In this phase, there is no guidance from the facilitator and participants are expected to demonstrate their “attack” capabilities within a stipulated time frame.
Note: We have fully kitted out labs with multiple scenarios & environments and unlike some other security programs, participants are not required to use their work laptop into a hostile environment.
Participants will be provided with:
- A thumb drive that has an environment containing key tools and vulnerable test environments so that participants can practice their skills outside of our “real world environment” lab
- Online learning support modules
- Additional resources to assist with taking the Ethical Hacker® assessment and the UK CREST® assessment without the need for further formal study
You will be able to
- Explain issues related to information security
- Identify a range of different security attacks and strategies employed to defend/mitigate effects
- Utilize a range of key security tools
- Perform a penetration test on a number of typical network & system environments
- Produce a report detailing system vulnerabilities and recommended strategies to mitigate them
- Outline key features of a security framework
Who can benefit
This course has been designed to be applicable to a number of industry/service sectors. It is suitable for a wide range of personnel that work on systems or networks.
This includes Penetration Testers, System administrators, IT systems personnel and engineers (Access, Core, IoT, Web, VAS, etc.)
Pre-requisite knowledge
- Good practical knowledge of computer networking, including the use of an analyser. This can be gained via Orbitage’s Certified IP Associate (CIPA) or an equivalent practical course
- Good practical knowledge of operating systems (Linux or MS Windows®) structure and commands. This can be gained via Orbitage’s Operating System course or an equivalent practical course.
Outline
Overview of Cyber Security Landscape
- Goals of Information Security
- Overview of the Cybersecurity Landscape
- Common attack strategies & attack types
- Common defence strategies
- Key security tools for attack & defence
- Security frameworks & standards
- Role of policies & procedures
- Business continuity & risk evaluation
Combat Rehearsal _ Penetration Testing
- Reconnaissance
- Attack Strategies & attack types
- Determining weaknesses & vulnerabilities
- Phishing & Social Engineering
- Identifying IPv4/v6 address ranges
- Network security issues (IPv4 and IPv6)
- Scanning & Enumeration
- Identifying & using appropriate tools
- Scanning (addresses, ports, DNS, etc.)
- Manipulating TCP flags & web banner grabbing
- OS Fingerprinting & network mapping
- Gaining Access
- Bypass defenses, SQL injection & cross-site scripting
- Data exfiltration
- MAC address manipulation & DNS poisoning
- Maintaining Access
- Installing backdoors, VPNs, Trojans, rootkits, etc.
- Creating new admin accounts
- Camouflaging and lateral movements
- Covering Tracks
- Sanitizing log files & manipulating time stamps
- Disabling audit controls
- Resetting ownerships
- Structured Documentation & Reporting of findings to Management
Security Campaign
- Using the knowledge and techniques gained, participants will engage in “Red Team” campaigns and real world attack and countermeasure scenarios
- The Blue Team (trainer) will use their skills to protect the target environment to thwart the attempts of the red team to compromise the system
- The participants will play the role of the Red Team and will use their skills to attack the environment and circumvent the attempts of the blue team to protect the system
Assessment & Certification
- Final Practical Assessment test & Certification Process
- Continual Assessment
- Knowledge written assessment (both short & long written questions)
- Practical “hands-on” assessment on a live network where the participant will need to show skills in reconnaissance and exploiting networks & services
- Participants will take the assessment individually
- Unique “live” network scenarios will be generated for each assessment
- Assessment duration is 3 hours
Programme scope, delivery arrangements and suitability are confirmed during enquiry.